Microsoft has informed IT admins that Copilot’s access to work documents is strictly controlled by the user account’s permissions, so enterprise data is protected.

Ignoring the “access does not mean permission” security principle, and the fact that permitting a human to read a document is not the same as permitting them to send it to an external server.